<html>
<head><meta charset="utf-8"><title>How best to issue a soundness-required breaking change? · general · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/index.html">general</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html">How best to issue a soundness-required breaking change?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="242130234"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242130234" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242130234">(Jun 09 2021 at 21:07)</a>:</h4>
<p>Hello, <code>bytemuck</code> author here. It's a crate for safe transmuting. It has a trait for "plain old data" types. On advice of some folks who seemed to know what they were talking about (who shall remain nameless to protect the innocent), an impl of this trait was added for the raw pointer types.</p>
<p>"you can do <code>raw_ptr as usize</code> and <code>usize as raw_ptr</code>, so obviously you must be able to transmute to usize or other pod type as well.", the logic went.</p>
<p>Well apparently not so! And now that trait impl has to go. While this is strictly a breaking change, the "unsoundness must always be fixed" clause overrides that.</p>
<p>The current crate version is 1.5.1, though i was about to release a 1.6.0 when I found out about this problem.</p>
<p><strong>question:</strong> Should I just release the 1.6 and yank all the past versions, or is there some better path?</p>



<a name="242131340"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242131340" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242131340">(Jun 09 2021 at 21:15)</a>:</h4>
<p>How long was the impl there for?</p>



<a name="242131514"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242131514" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242131514">(Jun 09 2021 at 21:15)</a>:</h4>
<p>like since pre 1.0, basically since i wrote the trait</p>



<a name="242131922"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242131922" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242131922">(Jun 09 2021 at 21:18)</a>:</h4>
<p>Worth reading <a href="https://github.com/briansmith/ring/issues/774">https://github.com/briansmith/ring/issues/774</a> to get informed on yanking.</p>



<a name="242131992"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242131992" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242131992">(Jun 09 2021 at 21:18)</a>:</h4>
<p>My immediate reaction in this instance would be to "just" release 2.0 and leave the other versions be.</p>



<a name="242132066"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132066" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132066">(Jun 09 2021 at 21:19)</a>:</h4>
<p>hmm, why is this unsound? does the impl apply to fat pointers?</p>



<a name="242132069"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132069" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132069">(Jun 09 2021 at 21:19)</a>:</h4>
<p>Then going through all dependents, getting them updated, and _maybe_ then yanking.</p>



<a name="242132205"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132205" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132205">(Jun 09 2021 at 21:20)</a>:</h4>
<p>ah, nevermind, I recall some discussions around this</p>



<a name="242132223"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132223" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132223">(Jun 09 2021 at 21:20)</a>:</h4>
<p>I do remember that ring thread.</p>
<p>Thankfully at least on this case the minimum rust version has not moved since 1.0, so anyone using 1.0 or later can surely move forward to 1.6</p>



<a name="242132252"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132252" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132252">(Jun 09 2021 at 21:20)</a>:</h4>
<p>I'm still hoping we can find a solution that doesn't require giving this up</p>



<a name="242132268"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132268" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132268">(Jun 09 2021 at 21:21)</a>:</h4>
<p>See <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/286">https://github.com/rust-lang/unsafe-code-guidelines/issues/286</a> for Soundness explanation</p>



<a name="242132336"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132336" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132336">(Jun 09 2021 at 21:21)</a>:</h4>
<p>TLDR is that this is <em>already</em> broken in current llvm. even if this is fixed in the future to become sound, it's not sound in today's rust.</p>



<a name="242132344"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132344" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132344">(Jun 09 2021 at 21:22)</a>:</h4>
<p>To be clear, it's not <em>currently</em> definitively UB, it's only broken with unclear semantics</p>



<a name="242132425"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132425" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132425">(Jun 09 2021 at 21:22)</a>:</h4>
<p>and one solution is to make it UB, while another solution is to make it defined and break other stuff</p>



<a name="242132720"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242132720" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242132720">(Jun 09 2021 at 21:24)</a>:</h4>
<p>and in particular there are several unresolved questions about the handling of pointers in stacked borrows that directly affect this issue. I don't really see this issue being resolved definitively until rust adopts SB or an alternative as the official memory model</p>



<a name="242133074"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242133074" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242133074">(Jun 09 2021 at 21:27)</a>:</h4>
<p>and re: llvm bugs, I think llvm is internally inconsistent here, so there is no choice of semantics that will make llvm do the right thing in all cases</p>



<a name="242134050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242134050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242134050">(Jun 09 2021 at 21:36)</a>:</h4>
<p>I'm not sure what the difference to the end user is to compare "definitely UB" vs "broken with unclear semantics".</p>
<p>They both sound equally harmful to the user's intent, and like you shouldn't do that thing.</p>



<a name="242134655"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242134655" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242134655">(Jun 09 2021 at 21:41)</a>:</h4>
<p>The difference is that if it's an LLVM bug then we can solve the issue there without changing peoples' code</p>



<a name="242134769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242134769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242134769">(Jun 09 2021 at 21:42)</a>:</h4>
<p>If it's a really long term bug then maybe users will want to work around it and that might look like an equivalent effect to UB</p>



<a name="242134819"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242134819" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242134819">(Jun 09 2021 at 21:42)</a>:</h4>
<p>The LLVM bug only triggers in fairly contrived conditions though AFAIK</p>



<a name="242134861"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242134861" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242134861">(Jun 09 2021 at 21:43)</a>:</h4>
<p>miscompiles aren't great regardless though</p>



<a name="242256400"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242256400" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242256400">(Jun 10 2021 at 19:16)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> my take on <em>your</em> situation: submit the breaking release without the impl for pointers, but keep the older version around. The idea is to ultimately yank the current versions, but not do it immediately.</p>
<ul>
<li>
<p>In the following paragraph, I'll call <code>1.a</code> your current (unsound) version, <code>2.0</code> the fixed one (semver incompatible), and <code>1.linted</code> one which would be semver compatible with <code>1.a</code> (<em>e.g.</em>, <code>linted = a + 1</code>).</p>
</li>
<li>
<p>One thing you could do, in the meantime, is to add a new semver-compatible version, <code>1.linted</code>, which only features the unsound impl through an <code>unsound-pointer-impl</code> feature. This would allow you to set up yanking the previous versions (<code>&lt; 1.linted</code>) (although you should wait a bit). That way, users that don't directly depend on <code>::bytemuck</code>, but who may be depending on a crate that transitively depends on something <code>&lt; 1.linted</code>, when they <code>cargo update</code>, they <em>would still be able to make their project compile</em> by enabling that linting feature themselves. Ideally, in order to do so, they'd check either your repo or the problematic intermediate crate relying on it, and submit an issue until they find out about the workaround, and the reasons for it. Once most of these intermediate crates have been fixed or are at least aware of the issue, you could yank the crates <code>&lt; 1.linted</code>.</p>
</li>
<li>
<p>That way you still force a bit the hand of the people depending on your crate, but at least you give a chance to all the end users to still make the compilation work.</p>
</li>
</ul>
<p>Note that the above suggestion does not need to be undertaken right away, maybe wait a few months until most users have already naturally transitioned to your <code>2.0</code> version.</p>
<p>FWIW, I personally think that it should be possible to do <code>cargo update -p bytemuck --precise 1.a.x --dangerous-allow-yanked</code>, with that command then displaying  a big warning about the operation, but still letting the operation go on. Fully breaking <code>Cargo.lock</code>-less transitively-dependent builds <em>with no solution whatsoever</em> cannot be better than depending on something potentially dangerous.</p>



<a name="242267458"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242267458" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242267458">(Jun 10 2021 at 20:38)</a>:</h4>
<p>Alright, <a href="https://github.com/Lokathor/bytemuck/pull/65">https://github.com/Lokathor/bytemuck/pull/65</a> does what you're suggesting, if I understand you properly.</p>



<a name="242267950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/How%20best%20to%20issue%20a%20soundness-required%20breaking%20change%3F/near/242267950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/How.20best.20to.20issue.20a.20soundness-required.20breaking.20change.3F.html#242267950">(Jun 10 2021 at 20:42)</a>:</h4>
<p>i'd wait for something more concrete before yanking, but i agree you should move towards removing it for now. that said, i suspect in practice a lot of code depends on the ability to transmute pointers &lt;=&gt; usize (usually in the context of arrays)...</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>